A crypto rug pull is one of the bluntest frauds in digital assets: the people behind a new token hype it up, collect investors’ money, then abruptly drain the project’s funds and disappear — leaving holders with tokens that are suddenly worthless. Unlike a slowly-built confidence scam, a rug pull can happen in hours. The mechanics are technical, but the warning signs are visible in advance if you know where to look.
This article explains how rug pulls work, walks through a documented enforcement case, and gives you a practical checklist for evaluating any new token before you buy.
What Is a Crypto Rug Pull?
In the SEC’s own words, a rug pull is trading behavior in which the holders of liquidity provider tokens “without warning, withdraw liquidity from a liquidity pool, sell significant amounts of crypto assets into the pool and cause losses to investors.” In plain terms: you buy a new token, and the insiders behind it yank the funds out from under you.
Rug pulls come in a few common forms:
Liquidity removal (the classic rug pull)
New tokens often trade on decentralized exchanges through “liquidity pools” — smart contracts holding a pair of assets (e.g., the new token plus a stablecoin) that let people buy and sell. The project team deposits the initial liquidity and receives liquidity provider (LP) tokens representing their share. In a legitimate project, those LP tokens are “locked” in a time-locked contract so insiders cannot remove the liquidity.
In a rug pull, the insiders never really lock the liquidity — or they find a way around the lock. Once enough buyers have poured money in, they redeem their LP tokens, withdraw everything, and the token’s price collapses to near zero.
The slow rug (“soft rug”)
Instead of one sudden withdrawal, insiders gradually sell off large token allocations they kept for themselves, often while continuing to hype the project on social media. The price bleeds out over weeks while retail buyers keep arriving.
Fake or malicious smart contracts
Some tokens are coded so that buyers cannot sell — the contract’s sell function is disabled or restricted to insiders only. Investors can watch their balance grow on paper but can never convert it back to real money. Other contracts include hidden “mint” functions that let insiders create unlimited new tokens and dump them.
Fake audits and fake locks
Projects display badges claiming “audited” or “liquidity locked,” but the audit was done by a firm nobody has heard of (or never happened), and the lock can be undone. As the SEC’s enforcement action below shows, claims of locked liquidity on social media can be outright false.
A Documented Case: The SEC’s Game Coin Action
Rug pulls are not just internet lore — they have been charged by federal regulators. On January 16, 2025, the SEC charged New York blockchain engineer Eric Zhu with perpetrating a fraud involving the “Game Coin” token (GME) that the SEC described as a rug pull:
- Zhu was hired to do coding work for Game Coin, whose founders told investors in public social media posts that the token’s liquidity was “locked” — meaning LP tokens could not be used by insiders to withdraw funds.
- According to the SEC’s complaint, certain LP tokens instead accrued to a blockchain address under Zhu’s exclusive control. He kept them unlocked and used them to drain the pool.
- The SEC alleged he misappropriated crypto assets worth approximately $553,000 and caused a 12% decline in the token’s price.
- Without admitting or denying the allegations, Zhu agreed to pay $672,992 in disgorgement and prejudgment interest plus a $150,000 civil penalty, subject to court approval.
This case matters because it shows the exact anatomy of a liquidity-based rug pull — public claims of locked liquidity, insiders holding unlocked LP tokens, and a sudden drain — and it was pursued by the SEC’s Crypto Assets and Cyber Unit.
Fake trading platforms are a related drain on wallets. In September 2026, the SEC charged Cryptoaiml Ltd. and three related entities with fraud, alleging they lured investors through WhatsApp groups into fake trading platforms showing fictitious profits, then blocked withdrawals and demanded advance fees while misappropriating more than $15 million combined. (The SEC’s allegations in that case have not been adjudicated by a court.) Whether the vehicle is a new token or a fake platform, the pattern is the same: impressive-looking returns, no real underlying activity, and an exit that leaves investors with nothing.
The Scale of Crypto Fraud
Context matters. The FBI’s 2025 Internet Crime Report, released in April 2026, recorded 1,008,597 complaints with reported losses of nearly $21 billion — up 26% from 2024. Investment fraud was the primary driver of losses, accounting for nearly half of scam-related losses, and crypto-related complaints (181,565 of them) totaled more than $11 billion in reported losses. FTC data summarized by AARP put 2025 investment-scam losses — often tied to cryptocurrency — at $7.9 billion. Rug pulls are one slice of this much larger crypto-fraud economy, and they thrive wherever hype outruns due diligence.
Red Flags of a Crypto Rug Pull
Run through this checklist before buying any new or small-cap token:
- Anonymous or unverifiable team. No real names, no LinkedIn profiles, no track record — just cartoon avatars and Telegram handles. Legitimate founders stand behind their work.
- Liquidity is not verifiably locked. If you cannot independently confirm a time-lock on the liquidity pool (through a known lock service or by reading the contract), assume it is not locked.
- Insiders hold a huge share of tokens. Check the token distribution: if the top few wallets control most of the supply, they can crash the price at will.
- You cannot find a credible audit. “Audited” means nothing without the name of a reputable firm and a public report you can read. A badge image is not an audit.
- The contract blocks selling. If test transactions or community reports show that buys work but sells fail, the token is a trap.
- Hype with no substance. Aggressive marketing, paid influencers, and promises of guaranteed multiples — but no working product, no documentation, no code repository.
- Brand-new token, instant exchange listing pressure. Urgency (“listing tomorrow, buy now”) is designed to stop you from doing the checks above.
- Copied or AI-generated whitepaper. Vague, buzzword-heavy documents with no technical detail are a classic sign.
- Social channels ban questions. If asking “is liquidity locked?” gets you muted or banned from the project’s Telegram or Discord, you have your answer.
How to Verify a Token Project Before You Buy
- Read the contract (or use tools that do). Blockchain explorers let you view a token’s smart contract. Free analysis tools can flag common malicious functions — disabled selling, unlimited minting, or owner-controlled trading pauses. You do not need to be a programmer to run a basic scan and read the warnings.
- Verify the liquidity lock yourself. Check whether LP tokens are held in a recognized time-lock contract and how long the lock lasts. A lock that expires next week is barely a lock.
- Inspect holder distribution. On a block explorer, look at the top token holders. Heavy concentration in a few wallets — especially wallets connected to the deployer — is a major risk signal.
- Confirm the audit. Find the auditing firm’s actual published report, not a screenshot on the project’s site. Read its findings, including the ones marked “critical.”
- Check the team’s real identities. Search names, look for prior projects, and be wary of teams that appeared out of nowhere last month.
- Start from the project’s official channels, not an influencer’s link. Scammers clone websites and social accounts. Verify handles and URLs through multiple independent sources.
- Never invest more than you can afford to lose in a new token. Even legitimate early-stage crypto assets are extremely volatile. This is not a safety claim — it is a risk boundary.
What to Do If You Suspect a Rug Pull
- Do not “buy the dip” or send more funds to “average down” — in a rug pull there is no recovery coming from the token itself.
- Document everything: the project’s website and social posts (screenshot them), the contract address, your transaction hashes, and wallet addresses involved.
- Report it to the FBI’s IC3 at ic3.gov, and to the FTC. The FBI specifically asks victims to document the scammer or company name, methods of contact, dates, payment methods, and where funds were sent.
- Report the token to the decentralized exchange or aggregator where you bought it — many maintain scam-token reporting features.
- Warn others in the project’s community channels, calmly and with evidence, so fewer people buy in after you.
The Bottom Line
A crypto rug pull works because it hijacks the most powerful force in crypto: the fear of missing out on the next big token. The Game Coin case shows that even a project with professional coding talent and public “locked liquidity” claims can be drained from the inside — which is exactly why verification must be independent, not based on the project’s own marketing. Check the lock, check the contract, check the team, and check the distribution. If any of those checks fail or cannot be performed, walk away. In the market for brand-new tokens, the projects that survive scrutiny are the exception — and that is precisely the point.
Sources
- SEC Litigation Release No. 26223, “SEC Charges New York Blockchain Engineer with Perpetrating ‘Rug Pull’ Fraud” (Jan. 16, 2025) — https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26223
- SEC press release 2026-95, “SEC Charges Multiple Entities in Fraud Schemes Totaling at Least $15 Million That Used WhatsApp and Other Platforms to Lure Investors” (Sept. 29, 2026) — https://www.sec.gov/newsroom/press-releases/2026-95-sec-charges-multiple-entities-fraud-schemes-totaling-least-15-million-used-whatsapp-other-platforms
- FBI press release, “Cryptocurrency and AI Scams Bilk Americans of Billions” (April 6, 2026) — https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
- AARP, “New FBI Report: $20.9 Billion Lost to Internet Crimes in 2025” (April 16, 2026) — https://www.aarp.org/money/scams-fraud/fbi-ftc-report-2025-losses/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.